build(deps): bump grpc to v1.83.2 and golang.org/x/net to v0.58.0 - #190
Merged
alex-herold merged 1 commit intoSep 4, 2026
Merged
Conversation
Consolidates Dependabot PRs #189 and #185, targeting the latest available versions instead of Dependabot's proposed 1.83.1/0.55.0 since both carry the same low risk profile. grpc-go >=1.81.0 requires Go >=1.25, so the go.mod toolchain directive and the 5 service Dockerfiles' base images are bumped alongside it.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
alex-herold
marked this pull request as ready for review
September 3, 2026 22:18
hugh-sublime
approved these changes
Sep 3, 2026
alex-herold
deleted the
alex.herold.upgrade-grpc-1-83-2-and-x-net-0-58-0
branch
September 4, 2026 13:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Consolidates Dependabot PRs #189 and #185, targeting the latest available versions (v1.83.2 for grpc, v0.58.0 for x/net) rather than Dependabot's proposed v1.83.1/v0.55.0 — both carry the same risk profile as the newer versions, so there's no reason to land the older ones.
Risk assessment summary:
grpc.DialContext/WithBlock/WithInsecure/credentials.NewClientTLSFromFile). Handled by bumpinggo.mod'sgodirective to 1.25.0 and the 5 service Dockerfiles'FROM golang:1.24→FROM golang:1.25. Also picks up several upstream security hardening fixes (xDS RBAC authz bypass, HTTP frame-flood mitigation) that don't apply to strelka's usage but are beneficial regardless.go mod whyconfirms the main module doesn't need it directly); zero call sites into any x/net subpackage anywhere in this codebase. Also fixes two CVEs (IDNA punycode confusion, html XSS) upstream.Verified with
go build ./...(clean) and confirmedgo vet/go testfindings are pre-existing onmain, unrelated to this change.Note: the two Dependabot cryptography PRs (#187, #184) are intentionally not included here — those were assessed separately as needing human review (one misses a relevant cert-chain DoS fix given strelka parses adversarial PE certificates) and are left open.